# Revamp: reward accounting drain via contribution sizing

Revamp's reward accounting let an attacker inflate a first contribution's pending reward to the 2x cap via a second contribution, then withdraw principal plus capped reward for 2.99 BNB profit.

- Payout: Real-world hack
- Severity: high
- Program: Revamp
- Credited: DeFiHackLabs
- Disclosed: 2026-03-19
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-03/Revamp_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260319-revamp
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:business-logic vuln:flash-loan vuln:reward-distribution

**Target:** BSC staking/revamp reward contract
**Root cause:** Pending reward is computed from total native contributed and capped at 2x, so a large second contribution from a helper address inflates the first address's pending reward to the cap without proportional time or risk.
**Steps:**
1. Flash loan `flashAmount = listingFee + firstContribution + secondContribution` WBNB from Pancake V3 pool and unwrap to BNB
2. Deploy fake ERC20 and call `listNewAsset{value: listingFee}(fakeToken, 18, "")`
3. Approve fake token; call `revamp{value: firstContribution}(fakeToken, 1e18, helper)` where firstContribution is grossed up so net equals half of Revamp's native balance
4. Transfer 1e18 fake tokens to helper; helper calls `revamp{value: secondContribution}(fakeToken, 1e18, attacker)` with secondContribution sized to 2x (totalNativeContributed + firstNetContribution)
5. Helper withdraws its principal; attacker reads `pendingReward` (now at 2x cap) and calls `withdraw(totalContributed + pending)`
6. Repay flash loan in WBNB and forward remaining BNB profit
**How found:** Attacker recognized that pending reward scales with totalNativeContributed and is capped at 2x, so a large contribution from a second address could inflate an earlier address's reward without waiting.
**Exploitation:** Attacker flash-borrows BNB, lists a worthless self-controlled token to satisfy the ERC20 requirement, makes a first contribution sized to half the contract's native balance, then a large second contribution from a helper address to push the first address's pending reward to the 2x cap. Both addresses withdraw principal and the first withdraws the capped reward; referral fees plus reward exceed the flash loan repayment, netting 2.99 BNB.
**Insight:** When a reward formula references global totals (totalNativeContributed) rather than per-user time-weighted stake, test whether a second address's large deposit can push a first address's pending reward to its cap; size the first deposit relative to contract balance to maximize the ratio.